CVE-2026-105570: Improper Handling of Case Sensitivity

Docker Sandboxes compared OAuth token-endpoint hostnames case-sensitively when deciding whether to mask managed credential responses, while request routing treated DNS hostnames case-insensitively. Untrusted code inside a sandbox could use a case-variant hostname to reach the genuine provider...

PT-2026-108208

Name of the Vulnerable Software and Affected Versions @fastify/reply-from versions prior to 12.7.0 Description Built-in HTTPS transports in this Fastify plugin override the secure default by setting rejectUnauthorized to false. This prevents the proxy from verifying the TLS certificate of the...

PT-2026-108181

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2.2 Description Sensitive credential material is exposed during the rotation processing of SECRET and API KEY. The edge-controller and edge-manager components log this information at the INFO level. An...

PT-2026-108132

Name of the Vulnerable Software and Affected Versions Docker Sandboxes affected versions not specified Description The egress proxy in Docker Sandboxes may forward client-supplied credentials along with credentials injected by the host. This occurs because the proxy only removes alternate...

PT-2026-108216

Name of the Vulnerable Software and Affected Versions Mechanize versions prior to 2.14.1 Description Mechanize leaks caller-supplied credential headers to a different host during an HTTP redirect. This occurs because Mechanizerequest headers= is reapplied by Mechanize::HTTP::Agentrequest add...

UBUNTU-CVE-2026-107231

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, Realm.Builder treats a Digest challenge that yields no usable nonce as a Basic challenge. A malicious origin or proxy can label a challen...

Mechanize sends credential headers to another origin after a meta refresh

Summary mechanize applied no trust boundary to a meta refresh, so credentials set through Mechanizerequestheaders= followed a refresh that pointed at another origin. Details Mechanize::HTTP::Agentresponsefollowmetarefresh fetched the refresh target with no notion of a crossed origin, so...

Linux Distros Unpatched Vulnerability : CVE-2026-107231

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1,...

EulerOS 2.0 SP15 : curl (EulerOS-SA-2026-3903)

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A use-after-free vulnerability exists in libcurl when an applicationx000D configures an HTTP/2 stream-dependency tree via CURLOPTSTREAMDEPENDS orx00...

EulerOS 2.0 SP15 : perl-HTTP-Tiny (EulerOS-SA-2026-3938)

According to the versions of the perl-HTTP-Tiny packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets.x000D x000D When the server returns ...

Linux Distros Unpatched Vulnerability : CVE-2026-107285

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, ...

DEBIAN-CVE-2026-107283

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, Realm.Builder generates the HTTP Digest client nonce with ThreadLocalRandom rather than a cryptographically secure random source. Digest...

CVE-2026-107283

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, Realm.Builder generates the HTTP Digest client nonce with ThreadLocalRandom rather than a cryptographically secure random source. Digest...

CVE-2026-107282

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, cross-host request replay updates the current request but leaves the target request and related proxy context pointing at the original...

CVE-2026-107285

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, a proxied ws request is carried through CONNECT, but NettyRequestFactory.newNettyRequest and requestUri decide whether to attach proxy...

CVE-2026-107282

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, cross-host request replay updates the current request but leaves the target request and related proxy context pointing at the original...

CVE-2026-107231

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, Realm.Builder treats a Digest challenge that yields no usable nonce as a Basic challenge. A malicious origin or proxy can label a challen...

CVE-2026-107285

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, a proxied ws request is carried through CONNECT, but NettyRequestFactory.newNettyRequest and requestUri decide whether to attach proxy...

CVE-2026-107285 AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, a proxied ws request is carried through CONNECT, but NettyRequestFactory.newNettyRequest and requestUri decide whether to attach proxy...

CVE-2026-107283

The AsyncHttpClient (AHC) library for Java applications is vulnerable to reduced authentication security due to the use of a non-cryptographic random source. In versions prior to 3.0.12 and 2.16.1 , the Realm.Builder component generates the HTTP Digest client nonce using ThreadLocalRandom instead...